1. NeuVector 安装
  1. 本文重点介绍安装部署，具体功能将在后续文章中深入介绍。
  2. NeuVector 安装
  3. 安装环境
    软件版本：
    OS：Ubuntu18.04
    Kubernetes：1.20.14
    Rancher：2.5.12
    Docker：19.03.15
    NeuVector：5.0.0-preview.1
  4. 2.1. 快速部署
  5. 创建 namespace
  6. kubectl create namespace neuvector
  7. 部署 CRD( Kubernetes 1.19+ 版本)
  8. kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/crd-k8s-1.19.yaml
  9. 部署 CRD(Kubernetes 1.18或更低版本)
  10. kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/crd-k8s-1.16.yaml
  11. 配置 RBAC
  12. kubectl create clusterrole neuvector-binding-app --verb=get,list,watch,update --resource=nodes,pods,services,namespaces
kubectl create clusterrole neuvector-binding-rbac --verb=get,list,watch --resource=rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io
kubectl create clusterrolebinding neuvector-binding-app --clusterrole=neuvector-binding-app --serviceaccount=neuvector:default
kubectl create clusterrolebinding neuvector-binding-rbac --clusterrole=neuvector-binding-rbac --serviceaccount=neuvector:default
kubectl create clusterrole neuvector-binding-admission --verb=get,list,watch,create,update,delete --resource=validatingwebhookconfigurations,mutatingwebhookconfigurations
kubectl create clusterrolebinding neuvector-binding-admission --clusterrole=neuvector-binding-admission --serviceaccount=neuvector:default
kubectl create clusterrole neuvector-binding-customresourcedefinition --verb=watch,create,get --resource=customresourcedefinitions
kubectl create clusterrolebinding  neuvector-binding-customresourcedefinition --clusterrole=neuvector-binding-customresourcedefinition --serviceaccount=neuvector:default
kubectl create clusterrole neuvector-binding-nvsecurityrules --verb=list,delete --resource=nvsecurityrules,nvclustersecurityrules
kubectl create clusterrolebinding neuvector-binding-nvsecurityrules --clusterrole=neuvector-binding-nvsecurityrules --serviceaccount=neuvector:default
kubectl create clusterrolebinding neuvector-binding-view --clusterrole=view --serviceaccount=neuvector:default
kubectl create rolebinding neuvector-admin --clusterrole=admin --serviceaccount=neuvector:default -n neuvector
  13. 检查是否有以下 RBAC 对象
  14. kubectl get clusterrolebinding  | grep neuvector
kubectl get rolebinding -n neuvector | grep neuvector

kubectl get clusterrolebinding  | grep neuvector

neuvector-binding-admission                            ClusterRole/neuvector-binding-admission                            44h
neuvector-binding-app                                  ClusterRole/neuvector-binding-app                                  44h
neuvector-binding-customresourcedefinition             ClusterRole/neuvector-binding-customresourcedefinition             44h
neuvector-binding-nvadmissioncontrolsecurityrules      ClusterRole/neuvector-binding-nvadmissioncontrolsecurityrules      44h
neuvector-binding-nvsecurityrules                      ClusterRole/neuvector-binding-nvsecurityrules                      44h
neuvector-binding-nvwafsecurityrules                   ClusterRole/neuvector-binding-nvwafsecurityrules                   44h
neuvector-binding-rbac                                 ClusterRole/neuvector-binding-rbac                                 44h
neuvector-binding-view                                 ClusterRole/view                                                   44h
  15. kubectl get rolebinding -n neuvector | grep neuvector
neuvector-admin         ClusterRole/admin            44h
neuvector-binding-psp   Role/neuvector-binding-psp   44h
  16. 部署 NeuVector
  17. 底层 Runtime 为 Docker
  18. kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/neuvector-docker-k8s.yaml
  19. 底层 Runtime 为 Containerd（对于 k3s 和 rke2 可以使用此 yaml 文件）
  20. kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/neuvector-containerd-k8s.yaml
  21. 1.21 以下的 Kubernetes 版本会提示以下错误，将 yaml 文件下载将 batch/v1 修改为 batch/v1beta1
  22. error: unable to recognize "https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/neuvector-docker-k8s.yaml": no matches for kind "CronJob" in version "batch/v1"
  23. 1.20.x cronjob 还处于 beta 阶段，1.21 版本开始 cronjob 才正式 GA 。
  24. 默认部署web-ui使用的是loadblance类型的Service，为了方便访问修改为NodePort，也可以通过 Ingress 对外提供服务
  25. kubectl patch  svc neuvector-service-webui  -n neuvector --type='json' -p '[{"op":"replace","path":"/spec/type","value":"NodePort"},{"op":"add","path":"/spec/ports/0/nodePort","value":30888}]'
  26. 访问 https://node_ip:30888
    默认密码为 admin/admin